Lecture IMAGE_EXPORT_DIRECTORY pour trouver des noms de fonction exportée provoque une violation d'accès

Question

Je lis IMAGE_EXPORT_DIRECTORY comme suit

PIMAGE_EXPORT_DIRECTORY ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD)dosHeader + ConvertRVA(PEImageOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress, 
     FirstSectionHeader,PEFileImageHeader)); 

Ce works.Then je veux accéder AddressOfNames.

PDWORD* ExportedFunctions; 
ExportedFunctions = (PDWORD *)((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeader,PEFileImageHeader)); 

Maintenant, comment puis-je trouver les noms des fonctions exportées? ConvertRVA() est défini comme

DWORD ConvertRVA(DWORD rva,PIMAGE_SECTION_HEADER FirstSectionHeader,PIMAGE_FILE_HEADER PEFileImageHeader) 
{ 
    int j=0; 
    auto i =FirstSectionHeader; 
    for(;j<PEFileImageHeader->NumberOfSections ;i++,j++) 
    { 
     if(rva>=i->VirtualAddress && rva<i->VirtualAddress + i->Misc.VirtualSize) 
      break; 
    } 
    return rva+i->PointerToRawData-i->VirtualAddress; 
} 

Answer 1

J'ai trouvé un moyen de le faire.

PDWORD ExportedFunctions; 
    ExportedFunctions = (PDWORD)((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeaderBest,PEFileImageHeader)); 



    for(int i=0;i<ExportDirectory->NumberOfNames;i++) 
    { 
     LPSTR aaaa=(PCHAR)((DWORD)dosHeader + ConvertRVA((DWORD)ExportedFunctions[0],FirstSectionHeaderBest,PEFileImageHeader)); 
     std::cout<<aaaa<<std::endl; 
    }